Appendix B

Comments on Draft COOP Report

Thank you for the opportunity to comment on the report, and for extending our time to do so.

Four managers reviewed the report, 2 of whom worked closely on the details of setting up after 9/11, and 2 of whom do not know the details of that project. In addition, our IT Specialist took a look.

1. We agree in principle with the conclusions - specifically that we need oversight from a central security professional. We would take that further and say that because of the level of detail that an effective COOP plan would need, and the testing it would take to ensure the components of the plan work, we would recommend that the agency assign this task to a COOP expert whose primary function is to develop the overall agency COOP strategy as well as the individual plans for the 51 field locations. This would mean visiting each office for a period of days to become familiar with the location, and work with the DRMs to develop specific plans for that office based on its size, location, and available equipment. And this person would also be responsible for ensuring that offices update and test COOP plans on some regular basis.

2. We recommend that COOP plans indicate:

-what kinds of events will trigger the plan — how long can an office be non-operational before we need to initiate a COOP plan. A week? 2 week? a month?

- what percentage of service and which services needs to be restored to be considered "continuing operations" - 100%, 50%? Intake? Litigation?

3. As the report mentions, we agree that much of the success of a COOP will depend on 2 things: the ability of the affected staff to communicate with one another and with HQ -or wherever the affected office's assistance is coming from- and 2) the affected staff's ability to access their files, most likely electronically. Thus, examining how data and applications are backed up, whether critical paper files should be scanned, who is responsible for getting staff connected (re-routed to different server, etc) from their alternative worksites in the event our server goes down, and what options we have for communication if phones or email aren't working. (E.g., If we understand it correctly, our network drives such as P and S and groupwise are on the local server - and would not be available to us from an alternate worksite if the NY server went down. In addition, the current protocol is that archived email is saved on individual hard drives D or C, which are not backed up — all that might be lost in the event of a fire, flood or other event that destroys a physical office.

We also recommend that part of any plan of support to an office in a COOP situation is to have a mechanism for quickly providing an emergency budget or source to get the staff who will continue operations the supplies & equipment they need from paper & postage to laptops, phones or fax capability, or whateve they need.

Finally, although actually COOP plans would need to be very detailed, we think that employees need to be given a few very simple points that they can easily remember in the event of a COOP event (maybe a palm card) - for example: 1. How to communicate with those in charge; 2. Where to go if the office evacuates in an emergency; 3) what methods of communication we'll use to get information out to staff (websites, althernate office locations, etc.)

I'm not sure if this is what you were looking for in comments, but hope it helps.

1. Our review of the field office COOP plans determined that the current plans do not address pandemic influenza as required by the Implementation Plan for the National Strategy for Pandemic Influenza.

Yet, you also state that "the draft [NOFO] plan addresses the following issues:

You are correct that the NOFO plan does address the pandemic influenza occurrence.

2. NOFO did in fact train each employee on the Draft NOFO COOP plan. Although incomplete at the time during hurricane season, management had the opportunity to address all aspects of the COOP plan with staff. Because there was a threat of a hurricane entering the Gulf of Mexico in 2007, NOFO used that opportunity to introduce staff to the procedures outlined in the plan.

3. Continuing operations while away from the office is an obvious concern since investigators cannot travel to secure places with the entire office inventory of active files nor given PII concerns would the agency want them to. As addressed in the NOFO plan, the virtual library or document scanning procedure for documents entering the agency is something that should be utilized. On occasion and as much as is feasiblely possible, NOFO is asking Respondents and CPs to provide information in electronic format.

4. NOFO will be sending someone to the COOP training this fiscal year.

5. Delegation of Authority: Since the Field Office reports to the District Office in Houston, coordination of responsibilities can be easily achieved. Management personnel in the District Office can be easily brought up to speed on Field Office operations and vice versa.

6. Communication: EEOC headquarters was able to distribute cell phones to office personnel as soon as individuals returned to New Orleans because communication here was still a problem. Since this was done in the aftermath of Katrina, (and I believe following 9/11) offices can anticipate this type of support from HQ.

7. NOFO plan does address telework under the Human Capital element. As stated in the NOFO COOP draft: Recent upgrade of the agency’s technology to laptops will allow employees to continue their work from remote locations. Investigators, mediators and attorneys should be able to continue to function in their mission areas. Advances that have been made by OHR to obtain emergency contact information from employees through employee express has standardized and will facilitate employee contact during an emergency. NOFO, during an emergency would again contact all employees and determine what assistance is needed during the emergency. Also, dismissal procedures are spelled out in the plan:

72 hours before predicted hurricane landfall, the New Orleans Field Office will institute its liberal leave policy. An employee who wishes to take leave to begin evacuation preparation may utilize annual leave to do so.

With 72 hours before landfall, the staff has been instructed on shut down procedures and dismissal.

8. Relocation is a serious issue and requires interaction with GSA and other federal, state and local law enforcement agencies. FEBs are addressing this issue. For small agencies however, being able to commit to an alternate worksite has huge budgetary implications. In addition, obtaining commercial space is dependant upon clearance from commercial owners and management and their insurance companies. Also, initially there was concern raised about toxic mold, lead and other contaminants in the area and environment. Reentry may also depend therefore on clearances from the EPA or state and local environmental enforcement agencies.

9. Issues regarding work space will arise in an emergency. Training staff to understand the need for adaptability will help reduce issues regarding temporary space or the construction of new space. Having some access to office files (as outlined in the COOP) addresses the issue of available work.

10. Overall, I believe the NOFO plan addresses in addition to those noted in your report the following:

Human Capital
Plans and Procedures
Vital Records

11. NOFO does need to address test, training and exercises and Reconstitution (Has budgetary implications and is dependent upon agency funds and space availability if relocation is required). This comes in to play only with long term impact. Short term impact is addressed in the NOFO COOP.

We agree that a Senior Accountable Officer be appointed to manage field COOP activities. We recommend that a Senior Executive Service level District Director be appointed as the Field COOP Accountable Officer. Headquarters oversight for field COOPs should flow from the current organization chart defined in Order 110. Therefore, the Director, Office of Field Programs should provide the necessary oversight for field COOPs. The Office of Chief Financial Officer could continue to be the Accountable Officer for the Headquarters COOP. COOP policy and procedures (i.e., dismissal procedures, guidelines for communicating to employees, staffing flexibilities, such as telework, technology, vital records, etc.) need to be provided from the Office of Human Resources and Office of Information Technology.

2. Pandemic Influenza

A contractor, Excalibur Associates, Inc., developed a pandemic template for EEOC headquarters and field offices and completed their work in December 2007. The template provides a framework for EEOC field offices to further develop comprehensive pandemic annexes to their existing EEOC COOP Plans. The COOP Pandemic Influenza Template is available on inSite. The Executive Briefing for Pandemic developed by the contractor was sent to Offices Directors on February 6, 2008.

3. Resources

In general, the agency has supported the COOP/Pandemic requirements using existing resources. If additional resources should be invested in the program, the earliest opportunity to make the budget business case would be for the fiscal year 2010 budget submission due to OMB this September. To date, OMB had not been receptive to adding any resources to enhance security or COOP functions.

This memorandum responds to your request for comments on the subject report. We concur in large part with the recommendations. First of all, I want to indicate my support for your primary recommendation (#1) contained in the report regarding the appointment of a senior accountable officer for COOP, who as part of that individual’s function, would assist field offices with the development, implementation and updating of COOP plans. As I know your review identified, this position requires a very particular, specialized knowledge necessary to ensure that COOPs are complete, compliant with all FEMA and other governmental standards, and integrated with EEOC’s overall security and safety management programs. It is clear that the field COOPs need to be integrated with both the Headquarters COOP and the larger realm of federal emergency preparedness. Therefore, it seems in the best interests of this agency to have the person responsible for the range of implementation of the COOP program to be part of the agency’s branch for security programs.

We also agree with recommendations #2 and #4, which would, respectively, have field office directors prepare COOP plans in accordance with governmental requirements and develop policies and procedures relating to the storage of mission critical field office electronic files on EEOC’s network drives. Additionally, we believe that the coverage of both recommendations be expanded to include Headquarters staff as well.

With respect to recommendation #3 that all field staff take the FEMA COOP Awareness training, we believe there may be a more tailored approach that could be of greater use not just to field staff but to all agency staff, including Headquarters. After reviewing the subject training, which is an hour-long on-line course, it appears to be a fairly general overview of the COOP, lacking specific details that would most inform our staff about their roles and responsibilities as well as agency procedures regarding the COOP, particularly with respect to EEOC protocol. Therefore, we would support the requirement that appropriate field staff (e.g., field managers and supervisors, District Resources Managers (DRMs), and DRM Assistants) as well as key Headquarters staff (managers, supervisors and office Administrative Officers and their staff) take this training. Indeed, there may be even more specific training available that these particular individuals need to take that would focus on the preparation of the COOP and specific aspects of coordination with EEOC’s Safety and Security Branch staff. We would recommend that a better use of staff time spent in COOP training would come from the agency creating a more tailored training for delivery by both Headquarters and Field Administrative managers to the staff in their respective offices, rather than FEMA’s generic training. EEOC’s training could outline the general concepts of the COOP as well as offer more detailed procedures applicable to their respective offices so that staff learn what they should do in the event of an emergency, including procedures for different scenarios (weather, geological, pandemic, terrorism, etc.) and the mechanisms the agency has in place to support field office responses. We believe with more detailed information, staff will be better able to respond appropriately and timely to events that necessitate the use of the COOP and related agency processes. This training could also be incorporated into the general orientation training for new staff when they begin working at EEOC.

Beyond these above comments expressing support for the recommendations, I want to offer some observations in specific categories about the report’s narrative description as it relates to the field’s COOP planning.

Field Office COOP Preparation

The report is critical of the New York and New Orleans offices not having COOP plans in place and following them during the major events that affected their offices (9/11 and Hurricane Katrina, respectively). Only in the summary of the New York offices’ response to 9/11 is there an acknowledgement that for New York, “[g]iven the overall lack of Federal experience and activity regarding COOP in 2001, this was an understandable shortcoming for EEOC.” Indeed, much of the federal government’s efforts on COOPs have been driven by the events of 9/11. The balance of the report regularly combines the responses to the 9/11 and Katrina events as one and cites the lack of an effective COOP as a failure on the part of EEOC. However, such a characterization is unfair to the New York office and to the agency in general. Furthermore, there is not an acknowledgement in the report that the New Orleans COOP, developed in the format designed by EEOC Headquarters, was not even workable given the scope and magnitude of the fallout resulting from Hurricane Katrina. Indeed, it is clear that all levels of the federal government, not just at EEOC, were ill-prepared for the type of response needed for this crisis. Therefore, the New Orleans field office should not be faulted for not following an unworkable COOP.

Agency’s Timeline for Implementation of COOP

EEOC’s adoption and implementation of the COOP process began with collecting the information from Headquarters offices beginning in November 2003, followed by the first call for COOPs in early FY 2004, and the request for the compilation of information from EEOC’s field offices in April 2, 2004. The request for Succession Plans from field offices was issued in May 2006 by the Chief Operating Officer. Thus, the overall organizational timeline for staff to become aware of COOPs and for field offices to develop proficiency in accurately preparing their COOPs has not been one of long duration.

Limitation of Field-Only Focus on COOP Implementation

We are concerned that by solely limiting the focus of examination of the COOP process to the field offices, a major link in the COOP implementation is missing. To truly assess the agency’s COOP activities, there should be full assessment of Headquarters’ role, both in providing guidance and in establishing procedures for responding to emergencies. The draft report should have a more balanced presentation including both headquarters and field responsibilities for COOPs.

Testing of COOPs

Another major criticism in the report regarding COOP activity in the field is the lack of testing of the COOPs. At this point in the agency’s development of COOP plans, field offices should not be chided for failing to conduct a testing exercise for which they have not been trained nor provided with the information for testing the COOP. While there are some offices that are part of a larger Federal Executive Board local network which may have conducted tests of the region, there has been no coordinated effort by EEOC Headquarters to instruct its field offices on the testing of the COOP.

OFP Use of COOPs and other Documentation for Field Events

The report also notes that the information collected during the 9/11 recovery efforts was not compiled into a single document that could be used as a guide by other field offices during a COOP. While the electronic files could be shared, we would caution against relying on them as a solution for all COOP plans. First, the information is dated. Circumstances in agency technology systems changed between the two events (9/11 and Katrina), with the shift from individual CDS servers with stored information in 2001 and the loss of the server as a result of 9/11 compared to the current Internet-based IMS data system which allowed for the access of all computer records maintained on charges in New Orleans. Now, with the purchase of docking stations for all field office staff with removable laptops and the establishment of VPN access to the EEOC network, technology is changing more. Second, the COOP must be flexible enough to account for different conditions. The loss of all agency paper records in 9/11 was not the situation in Katrina. Similarly, the result from the 9/11 event did not involve the displacement field staff from their homes as was the case with Katrina.

The report does not recognize that there were files maintained by more than one OFP staff (and shared with the OIG in the course of this review) that reflected the actions taken during 9/11. The information was shared with the New Orleans managers after Hurricane Katrina. The critical importance of this documentation is and was for use when the agency had to respond to other field office crises. Having a document sitting in a binder or in an electronic file in New York and New Orleans would not have helped either office since neither office could access paper or electronic records at their office. Headquarters must be flexible enough to develop responses that are specifically tailored to the individual needs created by each event that occurs. In that regard, coordination among headquarters offices to events in field locations is critical. We appreciate the opportunity to comment on the report. If you have any questions about these comments, please contact me or Sharon Bower of my staff at ext. 4841.

I was surprised to read in your report that there was a "lack of an Agency executive identified as a senior accountable official". Jeff Smith has been leading this effort for the EEOC for quite some time. In addition, there was no mention of OHR involvement. We have worked closely with CFO's group in planning and executing at times of disaster. In fact, the actions required in an emergency cannot happen without the involvement of CFO and OHR. There is no need to invent process, since there is a lot of guidance from OPM on this subject.

I don't disagree that more needs to happen to make the COOP plan more viable. Why not recommend that a committee be formed to formalize the process? Having the Field develop their own plans and activities is useless if the CFO and OHR are not involved.